Methodology

Open, reproducible, and auditable engagements.

We publish the frameworks we use, the tools we run, and the evidence we produce. No black-box vendor magic.

Methodology

How we work — open, reproducible, auditable.

Every engagement maps to published frameworks (PTES, OWASP WSTG / MASVS, OSSTMM, NIST SP 800-115, MITRE ATT&CK) so your auditors and engineers see the same story.

Phase 01

Scoping

Objectives, rules of engagement, threat model, success criteria.

Output · Signed SOW + ROE

Phase 02

Reconnaissance

Attack-surface discovery, asset graph, exposure scoring.

Output · Asset graph

Phase 03

Exploitation

Manual + tooled exploitation aligned to PTES, OWASP, MITRE ATT&CK.

Output · Kill-chain log

Phase 04

Reporting

Developer-grade writeups with reproduction, PoC, CVSSv4, and fix guidance.

Output · Finding + PoC

Phase 05

Remediation

Paired work with your engineering team; retests at no extra cost.

Output · Fix PR + retest

Phase 06

Continuous

Findings platform, weekly syncs, delta-retests on every release.

Output · Live dashboard

Read the full methodology

What every finding looks like

A finding is a contract. Engineers get reproducible steps, auditors get mapped evidence, and leaders get a measurable fix plan. Same shape. Every time.

findings/PS-1142.yaml

$ cat findings/PS-1142.yaml
id: PS-1142
severity: critical   # CVSSv4 9.1 · tenant-isolation bypass
scope: api.confidential-org.com/v2/orgs/:id/invoices
cwe: [CWE-639]  # Authorization Bypass Through User-Controlled Key
attack: [T1190, T1552.001]
 
repro:
  - login as tenant A, note org_id=77a2...
  - GET /v2/orgs/{victim_id}/invoices with A's session
  - server returns 200 + victim PII (7-line PoC attached)
 
fix:
  - enforce tenant-scope guard at router middleware
  - add contract test: cross-tenant GET must 403
  - detection: log org_id mismatch in access.log

Deliverables spec

Findings (per-bug)

·One-line summary + severity (CVSSv4 + business impact)
·Reproduction steps + PoC (shell, HTTP, script)
·Affected scope + data classes
·Fix guidance per layer (code, config, detection)
·References (CWE, CAPEC, ATT&CK, papers)

Engagement report

·Executive summary (1 page)
·Kill-chain narrative with timeline
·Finding catalog with appendices
·Methodology + framework mapping
·Retest delta + current posture

Integration

·Live dashboard (Jira / Linear / GitHub sync)
·Slack / Teams alert channel
·Webhook feed for your SIEM
·SOC 2 / ISO 27001 auditor export
·Atomic tests for your blue team

Frameworks we map to

Every engagement is mapped to published frameworks so your auditors, engineers, and board see the same story — in a language each already speaks.

PTES

Penetration Testing Execution Standard — seven-phase engagement lifecycle we anchor all pentests to.

OWASP WSTG

Web Security Testing Guide — our baseline for every web app engagement.

OWASP MASVS / MSTG

Mobile AppSec Verification Standard and Testing Guide — L2 minimum for every mobile engagement.

OWASP ASVS

Application Security Verification Standard — L3 for regulated environments.

OWASP API Top 10

API security baseline, including BOLA / BFLA coverage.

OWASP LLM Top 10

LLM / AI application security baseline.

OSSTMM

Open-Source Security Testing Methodology Manual — rigor for structured engagements.

NIST SP 800-115

Federal technical-guide framework for security assessments.

NIST CSF 2.0

Framework alignment for regulated customers (financial, healthcare, federal).

MITRE ATT&CK

Default mapping language for every red team and PTaaS engagement.

MITRE ATLAS

Adversarial ML threat matrix for AI / LLM engagements.

Our toolkit

We're tool-agnostic by default but this is the set we reach for most. Your stack wins over our preference — we'll bring our own if you don't already have one.

Offensive

Burp Suite ProNucleiffufSliverHavocImpacketCertipyBloodHound CE

Cloud

ProwlerScoutSuitePACUcloudfoxCartographyPrincipal Mapper

AppSec

SemgrepCodeQLSnykTrivyMobSFFridaObjection

AI / LLM

PyRITGarakpromptfooLangSmithLLM-eval (custom)

We publish the details

Engagement runbooks and report templates are shared upfront with every customer. No vendor-lock mystery. Ask during the scoping call — we'll send the latest.

Talk to an operator

Your next finding is one scoping call away.

Thirty minutes with a real operator tells us what you need and what we can deliver. No BDR handoff, no sales engineer theater — the person you talk to is the person who scopes the work.

hello@pentstark.com

Talk to an expertBook a demo

● Responses in < 1 business day